Canva data breach (2019): what happened and what to do
2 min read · Updated October 15, 2026
In May 2019 Canva reported that attackers had accessed user data. The breach was reported to involve about 137 million users and included usernames, email addresses, names and, for many accounts, hashed passwords. If you had a Canva account, change reused passwords and enable two-factor authentication.
What happened
Canva said an attacker had gained access to its systems and obtained user information. The company notified users, reset affected passwords and said it had taken steps to strengthen security.
What was exposed
- ✓Usernames, names and email addresses.
- ✓Hashed passwords for many accounts.
- ✓Other profile details such as city, depending on the account.
Were you caught up in a major breach?
Old breaches keep circulating for years. Check your email against known breach records for free.
Why it matters
People often sign in with email and password reused from other sites. Attackers use leaked pairs against more valuable accounts, so a creative-tool breach can still lead to email or banking risks if passwords were shared.
What to do
- ✓Check your email address to see whether it appears in known breach records.
- ✓Change any password you used on the affected service, and anywhere you reused it.
- ✓Turn on two-factor authentication, starting with email and financial accounts.
- ✓Be careful with unexpected messages that mention the service.
Frequently asked questions
Were payment details exposed?+
The company reported that payment card and financial data were not accessed. Review your statements if you are concerned.
Do I need to delete my account?+
Not necessarily. Secure it, or delete it if you no longer use it.
How do I check my exposure?+
Run your email through a breach checker.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.